Popular iOS Apps found to be recording user’s screens / sometimes exposing private data

Post Views: 275

An investigation by TechCrunch.com revealed that some iPhone apps are using services to record user’s screens from companies like Glassbox which claim to be a “customer experience analytics firm” to track user’s experiences when inside an app.

Thank you for reading this post, don't forget to subscribe!

Glassbox is one of the so-called analytics firms that employ “session replay technology.” This allows developers to record displays and review how users interacted with their app. “Every tap, button push, and keyboard entry is recorded,” TechCrunch says.

These session replays let app developers record the screen and play them back to see how its users interacted with the app to figure out if something didn’t work or if there was an error. Every tap, button push and keyboard entry is recorded — effectively screenshotted — and sent back to the app developers.

In a recent tweet, Glassbox said: “Imagine if your website or mobile app could see exactly what your customers do in real time, and why they did it?”

Further, The App Analyst recently discovered that the Air Canada iPhone app doesn’t properly mask session replays. This means sensitive information like passport numbers and credit card information is easily viewable to Air Canada employees. While this isn’t the case for all of the apps, Air Canada recently suffered a data breach affecting 20,000 user profiles, which doesn’t bode well for its security practices.

In some cases, apps send session replay data directly back to Glassbox servers, while some companies send it back to their own servers. In both cases, some data was found unmasked and easily accessible with man-in-the-middle tools:

To read the rest of the 9to5Mac article, click here.